Inbox rule
An inbox rule automatically applies actions to incoming email when specified conditions are met, such as moving, deleting, or forwarding matching messages.
What a rule can do
Rules make busy mailboxes manageable. They can move a newsletter into a folder or handle messages from a particular sender. Microsoft’s rule model separates conditions, exceptions, and actions; it also records whether a rule is enabled and its processing order.
The same feature can conceal correspondence after account compromise. MITRE documents attackers using email hiding rules to move or delete messages, including security notifications. A rule that looks like housekeeping may therefore deserve closer review when its conditions match the incident being investigated.
Look at the action, not just the rule name
A rule that moves messages out of the inbox is different from one that forwards copies outside the organization. The first can reduce visibility; the second can disclose information. Some rules may combine actions. Mailbox forwarding covers that delivery path and the controls that can block it.
Finding a rule does not prove it processed a particular message. Preserve the configuration and available change history, then connect the condition and action to the relevant correspondence. A message found in another folder could also have been moved manually.
The payroll inbox-concealment article follows this problem across mailbox and payroll records. Removing an abusive rule addresses its future processing; it does not settle what happened to earlier messages or any separate business change.